From 95bafb49804ba893e40f3f367c55ef9b0fa9e963 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Mon, 30 Sep 2024 23:53:53 +0200 Subject: [PATCH 1/3] ci: Improve usability of running different psalm modes locally Signed-off-by: Joas Schilling --- .github/workflows/static-code-analysis.yml | 6 +++--- .gitignore | 1 + composer.json | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/static-code-analysis.yml b/.github/workflows/static-code-analysis.yml index 83b7452ee896a..1fd77dccea49f 100644 --- a/.github/workflows/static-code-analysis.yml +++ b/.github/workflows/static-code-analysis.yml @@ -34,7 +34,7 @@ jobs: run: composer i - name: Psalm - run: composer run psalm:ci -- --monochrome --no-progress --output-format=github --update-baseline --report=results.sarif + run: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline --report=results.sarif - name: Show potential changes in Psalm baseline if: always() @@ -66,7 +66,7 @@ jobs: run: composer i - name: Psalm taint analysis - run: composer run psalm:ci -- --monochrome --no-progress --output-format=github --report=results.sarif --taint-analysis --ignore-baseline + run: composer run psalm:security -- --threads=1 --monochrome --no-progress --output-format=github --report=results.sarif - name: Upload Security Analysis results to GitHub if: always() @@ -96,7 +96,7 @@ jobs: run: composer i - name: Psalm - run: composer run psalm:ci -- -c psalm-ocp.xml --monochrome --no-progress --output-format=github --update-baseline + run: composer run psalm:ocp -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline - name: Show potential changes in Psalm baseline if: always() diff --git a/.gitignore b/.gitignore index 5b747559a8224..60be458133175 100644 --- a/.gitignore +++ b/.gitignore @@ -151,6 +151,7 @@ Vagrantfile # Tests - auto-generated files /data-autotest +/results.sarif /tests/.phpunit.result.cache /tests/coverage* /tests/css diff --git a/composer.json b/composer.json index d54807e9c8eda..86908c10c88fc 100644 --- a/composer.json +++ b/composer.json @@ -59,7 +59,8 @@ "cs:check": "php-cs-fixer fix --dry-run --diff", "lint": "find . -name \\*.php -not -path './lib/composer/*' -not -path './build/stubs/*' -print0 | xargs -0 -n1 php -l", "psalm": "psalm --no-cache --threads=$(nproc)", - "psalm:ci": "psalm --no-cache --threads=1", + "psalm:ocp": "psalm --no-cache --threads=$(nproc) -c psalm-ocp.xml", + "psalm:security": "psalm --no-cache --threads=$(nproc) --taint-analysis --ignore-baseline", "psalm:update-baseline": "psalm --no-cache --threads=$(nproc) --update-baseline", "serve": [ "Composer\\Config::disableProcessTimeout", From 990ee44015da720acbcf22dfe583b181dd1655fd Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Mon, 30 Sep 2024 23:57:39 +0200 Subject: [PATCH 2/3] ci: Don't upload output of normal psalm to GitHub Security section Signed-off-by: Joas Schilling --- .github/workflows/static-code-analysis.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/workflows/static-code-analysis.yml b/.github/workflows/static-code-analysis.yml index 1fd77dccea49f..63ad51a26c659 100644 --- a/.github/workflows/static-code-analysis.yml +++ b/.github/workflows/static-code-analysis.yml @@ -34,18 +34,12 @@ jobs: run: composer i - name: Psalm - run: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline --report=results.sarif + run: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline - name: Show potential changes in Psalm baseline if: always() run: git diff --exit-code -- . ':!lib/composer' - - name: Upload Analysis results to GitHub - if: always() - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: results.sarif - static-code-analysis-security: runs-on: ubuntu-latest From 570a9e208fa638c35f5ec1c9754acf2a66aa587d Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 1 Oct 2024 00:09:15 +0200 Subject: [PATCH 3/3] ci: Add psalm baseline for security and make CI fail on change Signed-off-by: Joas Schilling --- .github/CODEOWNERS | 2 +- .github/workflows/static-code-analysis.yml | 6 +- .reuse/dep5 | 2 +- build/psalm-baseline-security.xml | 138 +++++++++++++++++++++ composer.json | 2 +- 5 files changed, 146 insertions(+), 4 deletions(-) create mode 100644 build/psalm-baseline-security.xml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index e448bf922ced7..afe17a95f849b 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -37,9 +37,9 @@ /apps/files_trashbin/src* @skjnldsv # Security team +/build/psalm-baseline-security.xml @nickvergessen /resources/codesigning @mgallien @miaulalala @nickvergessen /resources/config/ca-bundle.crt @ChristophWurst @miaulalala @nickvergessen -/.drone.yml @nickvergessen # Two-Factor Authentication # https://github.com/nextcloud/wg-two-factor-authentication#members diff --git a/.github/workflows/static-code-analysis.yml b/.github/workflows/static-code-analysis.yml index 63ad51a26c659..c5e8e95707787 100644 --- a/.github/workflows/static-code-analysis.yml +++ b/.github/workflows/static-code-analysis.yml @@ -60,7 +60,11 @@ jobs: run: composer i - name: Psalm taint analysis - run: composer run psalm:security -- --threads=1 --monochrome --no-progress --output-format=github --report=results.sarif + run: composer run psalm:security -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline --report=results.sarif + + - name: Show potential changes in Psalm baseline + if: always() + run: git diff --exit-code -- . ':!lib/composer' - name: Upload Security Analysis results to GitHub if: always() diff --git a/.reuse/dep5 b/.reuse/dep5 index 940d816081596..7cbbb64b63c21 100644 --- a/.reuse/dep5 +++ b/.reuse/dep5 @@ -103,7 +103,7 @@ Files: core/img/desktopapp.svg Copyright: 2016-2024 Nextcloud GmbH and Nextcloud contributors License: AGPL-3.0-or-later -Files: build/psalm-baseline-ocp.xml build/psalm-baseline.xml build/stubs/xsl.php build/stubs/gd.php build/stubs/imagick.php build/stubs/intl.php build/stubs/IntlChar.php build/stubs/ldap.php build/stubs/memcached.php build/stubs/redis.php build/stubs/redis_cluster.php build/stubs/sftp.php build/stubs/ssh2.php build/stubs/apcu.php +Files: build/psalm-baseline-ocp.xml build/psalm-baseline-security.xml build/psalm-baseline.xml build/stubs/xsl.php build/stubs/gd.php build/stubs/imagick.php build/stubs/intl.php build/stubs/IntlChar.php build/stubs/ldap.php build/stubs/memcached.php build/stubs/redis.php build/stubs/redis_cluster.php build/stubs/sftp.php build/stubs/ssh2.php build/stubs/apcu.php Copyright: 2020 Nextcloud GmbH and Nextcloud contributors License: AGPL-3.0-or-later diff --git a/build/psalm-baseline-security.xml b/build/psalm-baseline-security.xml new file mode 100644 index 0000000000000..c42b10d75c677 --- /dev/null +++ b/build/psalm-baseline-security.xml @@ -0,0 +1,138 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cache]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + getPathname(), '.php')]]> + + + + + + + + + + passphrase]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + getTraceAsString()]]> + + + getTraceAsString()]]> + + + + + + + + + + + + + + + + + + buildProviderList()->render()]]> + + + buildProviderList()->render()]]> + + + diff --git a/composer.json b/composer.json index 86908c10c88fc..5912a81f98785 100644 --- a/composer.json +++ b/composer.json @@ -60,7 +60,7 @@ "lint": "find . -name \\*.php -not -path './lib/composer/*' -not -path './build/stubs/*' -print0 | xargs -0 -n1 php -l", "psalm": "psalm --no-cache --threads=$(nproc)", "psalm:ocp": "psalm --no-cache --threads=$(nproc) -c psalm-ocp.xml", - "psalm:security": "psalm --no-cache --threads=$(nproc) --taint-analysis --ignore-baseline", + "psalm:security": "psalm --no-cache --threads=$(nproc) --taint-analysis --use-baseline=build/psalm-baseline-security.xml", "psalm:update-baseline": "psalm --no-cache --threads=$(nproc) --update-baseline", "serve": [ "Composer\\Config::disableProcessTimeout",